tiny-encrypt-rs

重要：要使用 tiny-encrypt，需要一个 Yubikey(https://www.yubico.com/products/)，密钥必须支持 PIV 或 OpenPGP。

Rust 的 tiny-encrypt

规范：[Tiny Encrypt 规范 V1.1](https://github.com/OpenWebStandard/tiny-encrypt-format-spec/blob/main/TinyEncryptSpecv1.1.md)

tiny-encrypt rs 是 Tiny encrypt java 的 Rust 实现 https://git.hatter.ink/hatter/tiny-encrypt-java
查看 Tiny encrypt 规范：[Tiny Encrypt 规范](https://github.com/OpenWebStandard/tiny-encrypt-format-spec)

仓库地址：[https://git.hatter.ink/hatter/tiny-encrypt-rs](https://git.hatter.ink/hatter/tiny-encrypt-rs) 镜像 [https://github.com/jht5945/tiny-encrypt-rs](https://github.com/jht5945/tiny-encrypt-rs)

加密配置 ~/.tinyencrypt/config-rs.json

{
  "envelops": [
    {
      "type": "pgp",
      "kid": "KID-1",
      "desc": "this is key 001",
      "publicPart": "----- BEGIN PUBLIC KEY ..."
    },
    {
      "type": "ecdh",
      "kid": "KID-2",
      "desc": "this is key 002",
      "publicPart": "04..."
    }
  ],
  "profiles": {
    "default": [
      "KID-1",
      "KID-2"
    ],
    "l2,leve2": [
      "KID-2"
    ]
  }
}

支持的 PKI 加密类型

智能卡(Yubikey)保护下的 ECDH 加密描述

┌───────────────────┐                     ┌───────────────────────────┐
│Tiny Encrypt       │                     │Smart Card (Yubikey)       │
│                   │  Get Public Key(P)  │                           │
│                   │ ◄───────────────────┤ Private Key(d)            │
│                   │                     │ P = dG                    │
│                   │ Temp Private Key(k) │                           │
└───────────────────┘ Q = kG              └───────────────────────────┘

                      Shared Secret = kP = kdG

                      Store Q, Encrypt using derived key from Shared Secret


                      Send Q to Smart Card
                      ───────────────────►
                                          Shared Secret = dQ = kdG

                               Decrypt using derived key from restored Shared Secret